The vulnerability is an Insecure Direct Object Reference that permits any authenticated user with a subscriber role or higher to upload media to an album belonging to another user. Because the plugin does not verify that the target album is owned or writable by the requester, an attacker can add files to a victim’s private album, causing the media to be attributed to the victim account. The flaw directly enables unauthorized placement of content in protected user spaces.

The rtMedia plugin for WordPress, BuddyPress and bbPress, any release prior to 4.7.14, is affected. No additional vendor or package mapping was reported, so all installations running an older release of this plugin are vulnerable.

The CVSS score of 4.3 places the weakness in the medium‑severity range, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker needs to be authenticated with at least a subscriber role and can craft an upload request specifying an arbitrary album ID; the plugin will accept the media and place it in the target private album because ownership checks are omitted.